STE WILLIAMS

Hadoop databases haven’t been getting much interest from hackers so far, compared to other data silos, but that’s changing, according to a new study.

Security shop Securonix, reports that its research team has seen a sharp rise in attacks targeting vulnerabilities in Hadoop components such as Hadoop YARN, Redis, and ActiveMQ in recent months.

The team found that the cyber-assaults ranged from single forays to more complex attacks exploiting multiple vulnerabilities ranging from unauthenticated command vulnerabilities and remote command execution holes to remote file execution flaws.

What the attackers are looking to do in each case is get access to the software platform’s underlying Linux or Windows servers, which are then infected with malware. This software nasty generates cryptocurrency for the miscreants, inject a dose of ransomware, and/or raid the boxes for corporate secrets and personal data.

“In most cases, the focus of the attacks is on installing a second-stage payload for cryptomining and/or remote access,” Securonix said in its report.

“In other cases, the malware propagates and infects the exposed services, removes data, and installs second-stage cryptomining and ransomware payloads.”

Apache Hadoop spins cracking code injection vulnerability YARN

READ MORE

One nasty in particular that’s thrown at Hadoop installations is the Xbash botnet malware, a Swiss Army knife of cyber-woe. Bots scan blocks of IP addresses for open ports on services like Redis (along with the likes of MySQL, Oracle Database, and Elastic Search) in search of servers to pwn.

If Xbash hits a vulnerable server, and can infect it, it first wipes the host’s databases and then tries to collect a ransom payout by pretending the wiped data is only encrypted.

“Once the malware is successfully able to log into the database services (MYSQL, PostgreSQL, MongoDB, or phpMyAdmin) it deletes the existing databases stored on the server and creates a database with a ransom note specifying the amount and the bitcoin wallet.”

Another infection spotted in the wild was the more basic Moanacroner malware, a modified version of the Sustes nasty that runs silently on the host server to mine Monero for the attacker.

In both cases, the Securonix researchers say that admins can reduce the chance of infection by keeping up on patches (the observed attacks all targeted known and patched vulnerabilities) and reducing the attack service by limiting what Hadoop services can be accessed remotely and, if possible, running services in protected modes. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/24/hadoop_malware_attack/

Comment An alliance of Australia’s tech and industry advocacy groups hopes, yet again, to have the country’s encryption-busting legislation tweaked before the government goes to an election no later than May.

Rather than a complete repeal of the Telecommunications (Assistance and Access) Act, the Communications Alliance-led group is asking for amendments, some proposed by the Australian Labor Party (but withdrawn to let the bill pass), that it hopes would improve citizens’ protection under the legislation.

The focus seems to be “the art of the possible”: there’s no call for a repeal of the legislation, but rather, an extension of judicial oversight, and more defined limits on agencies’ powers under the various notices permitted in the laws.

Oz opposition folds, agrees to give Australians coal in their stockings this Christmas

READ MORE

The Australian Communications Alliance said the group wants a warrant-based system for all notices, to provide judicial consent before providers have to comply with agency notices.

The group believes the risk of accidental “backdoors” in communications systems and software would be reduced if amendments could “clearly articulate and narrow the limits of what agencies can request”.

The range of offences should also be narrowed, the groups has argued.

The legislation passed last year allows agencies to demand assistance accessing the communications of subjects of investigation, if the crime under investigation has a penalty of three years’ prison. The industry wants that increased to seven years, to avoid relatively minor investigations being used as the basis for an access or assistance request.

The other wishlist items are that the government consults with communications providers before requiring them to comply with notices, and that providers be able to refuse agencies’ notices if they would put the provider in breach with foreign law.

The list of signatories to the submission is the Communications Alliance, the Australian Industry Group (Ai Group), the Australian Information Industry Association (AIIA), the Australian Mobile Telecommunications Association (AMTA), the Information Technology Professionals Association (ITPA) and Digital Industry Group (DIGI).

As we’ve previously noted, DIGI is the Australian lobby representing Facebook, Google, Twitter, Yahoo!, YouTube and others.

How do you break encryption without breaking encryption?

The Register networks correspondent isn’t so sure the industry lobbies are taking the right path here.

Somehow improving the regime, whether it’s making it harder to get assistance/access notices issued, warrant requirements, or restricting the kinds of investigations that can use the legislation – none of this addresses the core issue: nobody has demonstrated how you can break encryption without breaking encryption.

UK spies: You know how we said bulk device hacking would be used sparingly? Well, things have ‘evolved’…

READ MORE

GCHQ’s November 2018 “virtual crocodile clips” proposal was hailed by some as solving the problem. In reality, it breaks encryption by stripping away trust in user authentication, rather than breaking a cipher.

“Making this bad thing a little less bad” feels at best like minimalism: a tacit admission that tech has lost the debate.

That shouldn’t surprise anybody. Since the days when this publication was dubbing ’90s-era communications minister Richard Alston the “biggest Luddite in history”, tech has had its arguments overruled by Canberra: the NBN’s fibre-to-the-home premise was gutted for the expensive “multi-technology model”, movie studios can get courts to poison ISPs’ DNS records in a regime expanded last year to sweep up Google, and the government’s telecommunications data retention scheme happened against tech’s objections.

It’s hardly encouraging. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/24/tech_sector_australia/

Comment An alliance of Australia’s tech and industry advocacy groups hopes, yet again, to have the country’s encryption-busting legislation tweaked before the government goes to an election no later than May.

Rather than a complete repeal of the Telecommunications (Assistance and Access) Act, the Communications Alliance-led group is asking for amendments, some proposed by the Australian Labor Party (but withdrawn to let the bill pass), that it hopes would improve citizens’ protection under the legislation.

The focus seems to be “the art of the possible”: there’s no call for a repeal of the legislation, but rather, an extension of judicial oversight, and more defined limits on agencies’ powers under the various notices permitted in the laws.

Oz opposition folds, agrees to give Australians coal in their stockings this Christmas

READ MORE

The Australian Communications Alliance said the group wants a warrant-based system for all notices, to provide judicial consent before providers have to comply with agency notices.

The group believes the risk of accidental “backdoors” in communications systems and software would be reduced if amendments could “clearly articulate and narrow the limits of what agencies can request”.

The range of offences should also be narrowed, the groups has argued.

The legislation passed last year allows agencies to demand assistance accessing the communications of subjects of investigation, if the crime under investigation has a penalty of three years’ prison. The industry wants that increased to seven years, to avoid relatively minor investigations being used as the basis for an access or assistance request.

The other wishlist items are that the government consults with communications providers before requiring them to comply with notices, and that providers be able to refuse agencies’ notices if they would put the provider in breach with foreign law.

The list of signatories to the submission is the Communications Alliance, the Australian Industry Group (Ai Group), the Australian Information Industry Association (AIIA), the Australian Mobile Telecommunications Association (AMTA), the Information Technology Professionals Association (ITPA) and Digital Industry Group (DIGI).

As we’ve previously noted, DIGI is the Australian lobby representing Facebook, Google, Twitter, Yahoo!, YouTube and others.

How do you break encryption without breaking encryption?

The Register networks correspondent isn’t so sure the industry lobbies are taking the right path here.

Somehow improving the regime, whether it’s making it harder to get assistance/access notices issued, warrant requirements, or restricting the kinds of investigations that can use the legislation – none of this addresses the core issue: nobody has demonstrated how you can break encryption without breaking encryption.

UK spies: You know how we said bulk device hacking would be used sparingly? Well, things have ‘evolved’…

READ MORE

GCHQ’s November 2018 “virtual crocodile clips” proposal was hailed by some as solving the problem. In reality, it breaks encryption by stripping away trust in user authentication, rather than breaking a cipher.

“Making this bad thing a little less bad” feels at best like minimalism: a tacit admission that tech has lost the debate.

That shouldn’t surprise anybody. Since the days when this publication was dubbing ’90s-era communications minister Richard Alston the “biggest Luddite in history”, tech has had its arguments overruled by Canberra: the NBN’s fibre-to-the-home premise was gutted for the expensive “multi-technology model”, movie studios can get courts to poison ISPs’ DNS records in a regime expanded last year to sweep up Google, and the government’s telecommunications data retention scheme happened against tech’s objections.

It’s hardly encouraging. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/24/tech_sector_australia/

Google Project Zero bug-hunter Tavis Ormandy took a “random look at the new release” of Ghostscript, and found a partly addressed vulnerability that works in all versions up to 9.26.

Ormandy made his latest discovery on 11 December, while reviewing a patch sent to him by devs at Artifex, which developed Ghostscript. With fresh patches available, he went public with the bug today.

The tl;dr of it is that Ghostscript coding demands very careful handling of pseudo-operators, or the code can leak enough about itself through error messages that an attacker can take control.

Ghostscript is a Postscript and Adobe PDF interpreter that lets *nix users view PDFs. However, web servers also inherit Ghostscript vulnerabilities, because toolkits like ImageMagick use it to wrangle PDFs and other images users are viewing.

What he found relates to what happens to subroutines buried inside pseudo-operators – and here, El Reg needs to take a deep breath.

To protect subroutines so end-users can’t look inside them (looking for “operators they shouldn’t be allowed to use,” he explained), they needed to be marked as executeonly.

So far, so good, but Ormandy goes on to explain that the subroutine’s contents also need to be protected from exposing their contents to error-handlers, using the odef command, which turns them into pseudo-operators. It gets kind of recursive after that, because the pseudo-operator isn’t a complete protection. As he wrote in the title, “subroutines within pseudo-operators must themselves be pseudo-operators”.

If the programmer forgets that (or didn’t know it in the first place: “nobody ever said writing postscript was easy, lol,” he quipped), operators can still end up being pushed onto the operand stack, and if there’s some kind of stack overflow error in the code, that is exposed to the error handlers and potentially viewable and exploitable from the outside.

While the bugs are tricky to exploit, Ormandy offered a proof of concept that “gives me a high degree of control over the routine” that works with “Evince, ImageMagick, Nautilus” as well as the Gimp editor and other libraries.

After much back-and-forth, fresh patches were emitted by Ghostscript, which Ormandy linked to at the bottom of his post.

However, he’s still wary of the whole thing, writing that “untrusted postscript needs to be deprecated ASAP”, something that echoed his August 2018 call for GhostScript to be dumped. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/24/pdf_ghostscript_vulnerability/

Google Project Zero bug-hunter Tavis Ormandy took a “random look at the new release” of Ghostscript, and found a partly addressed vulnerability that works in all versions up to 9.26.

Ormandy made his latest discovery on 11 December, while reviewing a patch sent to him by devs at Artifex, which developed Ghostscript. With fresh patches available, he went public with the bug today.

The tl;dr of it is that Ghostscript coding demands very careful handling of pseudo-operators, or the code can leak enough about itself through error messages that an attacker can take control.

Ghostscript is a Postscript and Adobe PDF interpreter that lets *nix users view PDFs. However, web servers also inherit Ghostscript vulnerabilities, because toolkits like ImageMagick use it to wrangle PDFs and other images users are viewing.

What he found relates to what happens to subroutines buried inside pseudo-operators – and here, El Reg needs to take a deep breath.

To protect subroutines so end-users can’t look inside them (looking for “operators they shouldn’t be allowed to use,” he explained), they needed to be marked as executeonly.

So far, so good, but Ormandy goes on to explain that the subroutine’s contents also need to be protected from exposing their contents to error-handlers, using the odef command, which turns them into pseudo-operators. It gets kind of recursive after that, because the pseudo-operator isn’t a complete protection. As he wrote in the title, “subroutines within pseudo-operators must themselves be pseudo-operators”.

If the programmer forgets that (or didn’t know it in the first place: “nobody ever said writing postscript was easy, lol,” he quipped), operators can still end up being pushed onto the operand stack, and if there’s some kind of stack overflow error in the code, that is exposed to the error handlers and potentially viewable and exploitable from the outside.

While the bugs are tricky to exploit, Ormandy offered a proof of concept that “gives me a high degree of control over the routine” that works with “Evince, ImageMagick, Nautilus” as well as the Gimp editor and other libraries.

After much back-and-forth, fresh patches were emitted by Ghostscript, which Ormandy linked to at the bottom of his post.

However, he’s still wary of the whole thing, writing that “untrusted postscript needs to be deprecated ASAP”, something that echoed his August 2018 call for GhostScript to be dumped. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/24/pdf_ghostscript_vulnerability/

Come to Black Hat Asia in March for an expert look at what’s happening in the world of Internet of Things, and what you can do to secure it.

The so-called “Internet of Things” grows larger and more complicated every day, and cybersecurity professionals need to stay on top of it.

That’s tricky business now that so many devices are capable of processing and exchanging data, but Black Hat Asia returns to Singapore in March with a smorgasbord of practical Briefings and demos aimed at helping you become an IoT master.

With the leak of Mirai botnet source code back in 2016, countless IoT botnet variants have emerged and evolved as part of a larger trend. Get an inside look at how they work and what they’re up to in “Pwning the Core of IoT Botnets: From a Honeypot to Gigabytes of Botnet Source Code”, a 50-minute Briefing in which you’ll see how even a single honeypot can lead to the discovery of gigabytes of botnet source code, uncovering various dramatic scenes among the bot herders behind the curtain.

In “Dive into VxWorks Based IoT Device: Debug the Undebugable Device” an expert will show at how to debug VxWorks, that popular IoT operating system that can be challenging to test and fix since it’s often running on devices without debuggers. This 50-minute Briefing aims to demonstrate how to find vulnerabilities in VxWorks devices via techniques like fuzzing, and debug VxWorks-based IoT devices without built-in debuggers.

You’ll also want to swing by the Arsenal at Black Hat Asia to check out demos of some of the new open-source tools designed specifically for IoT work For example, capable folks love the notion of a good Swiss army knife, and that’s exactly what “MQTT-PWN: Your IoT Swiss-Army Knife” offers. MQTT is a machine-to-machine connectivity protocol designed as an extremely lightweight publish/subscribe messaging transport, one widely used by millions of IoT devices worldwide. MQTT-PWN intends to be a one-stop-shop for IoT broker penetration-testing and security assessment operations. It combines enumeration, supportive functions and exploitation modules while packing it all within command-line-interface with an easy-to-use and extensible shell-like environment. A full circle scenario of attacks will be demonstrated for you that you won’t want to miss!

“Cotopaxi: IoT Protocols Security Testing Toolkit” will also be in the Arsenal this year, and this highly useful toolkit for testing and securing IoT devices is worth checking out since new IoT protocols are being widely used in both public networks and industrial environments. Unfortunately, in most cases those servers are not configured properly or use outdated components. The Cotopaxi toolkit is designed specifically to help ferret out those weak points, using new IoT protocols like CoAP, mDNS, and HTCPCP. Check it out!

And make sure to catch a demo of “IoT Hunter: A Framework Tool for Building IoT Threat Intelligence System,” a tool from the Tencent Antivirus Lab that contains all important modules for IOT threat analysis, including information collection, data extraction, threat data analysis, and intelligence visualization.

IoT Hunter can provide (but isn’t limited to) static information extraction, dynamic operation information extraction, and third-party network platform information. It’s designed to help security researchers quickly and easily build their own IOT intelligence platform for IOT malware research and threat tracking.

Black Hat Asia returns to the Marina Bay Sands in Singapore March 26-29, 2019. Early registration pricing for Briefings Trainings ends Friday, January 18, so register before then to get the best price!

For more information on what’s happening at the event and how to register, check out the Black Hat website.

Article source: https://www.darkreading.com/black-hat/black-hat-asia-offers-new-iot-security-tools-and-tricks/d/d-id/1333712?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Come to Black Hat Asia in March for an expert look at what’s happening in the world of Internet of Things, and what you can do to secure it.

The so-called “Internet of Things” grows larger and more complicated every day, and cybersecurity professionals need to stay on top of it.

That’s tricky business now that so many devices are capable of processing and exchanging data, but Black Hat Asia returns to Singapore in March with a smorgasbord of practical Briefings and demos aimed at helping you become an IoT master.

With the leak of Mirai botnet source code back in 2016, countless IoT botnet variants have emerged and evolved as part of a larger trend. Get an inside look at how they work and what they’re up to in “Pwning the Core of IoT Botnets: From a Honeypot to Gigabytes of Botnet Source Code”, a 50-minute Briefing in which you’ll see how even a single honeypot can lead to the discovery of gigabytes of botnet source code, uncovering various dramatic scenes among the bot herders behind the curtain.

In “Dive into VxWorks Based IoT Device: Debug the Undebugable Device” an expert will show at how to debug VxWorks, that popular IoT operating system that can be challenging to test and fix since it’s often running on devices without debuggers. This 50-minute Briefing aims to demonstrate how to find vulnerabilities in VxWorks devices via techniques like fuzzing, and debug VxWorks-based IoT devices without built-in debuggers.

You’ll also want to swing by the Arsenal at Black Hat Asia to check out demos of some of the new open-source tools designed specifically for IoT work For example, capable folks love the notion of a good Swiss army knife, and that’s exactly what “MQTT-PWN: Your IoT Swiss-Army Knife” offers. MQTT is a machine-to-machine connectivity protocol designed as an extremely lightweight publish/subscribe messaging transport, one widely used by millions of IoT devices worldwide. MQTT-PWN intends to be a one-stop-shop for IoT broker penetration-testing and security assessment operations. It combines enumeration, supportive functions and exploitation modules while packing it all within command-line-interface with an easy-to-use and extensible shell-like environment. A full circle scenario of attacks will be demonstrated for you that you won’t want to miss!

“Cotopaxi: IoT Protocols Security Testing Toolkit” will also be in the Arsenal this year, and this highly useful toolkit for testing and securing IoT devices is worth checking out since new IoT protocols are being widely used in both public networks and industrial environments. Unfortunately, in most cases those servers are not configured properly or use outdated components. The Cotopaxi toolkit is designed specifically to help ferret out those weak points, using new IoT protocols like CoAP, mDNS, and HTCPCP. Check it out!

And make sure to catch a demo of “IoT Hunter: A Framework Tool for Building IoT Threat Intelligence System,” a tool from the Tencent Antivirus Lab that contains all important modules for IOT threat analysis, including information collection, data extraction, threat data analysis, and intelligence visualization.

IoT Hunter can provide (but isn’t limited to) static information extraction, dynamic operation information extraction, and third-party network platform information. It’s designed to help security researchers quickly and easily build their own IOT intelligence platform for IOT malware research and threat tracking.

Black Hat Asia returns to the Marina Bay Sands in Singapore March 26-29, 2019. Early registration pricing for Briefings Trainings ends Friday, January 18, so register before then to get the best price!

For more information on what’s happening at the event and how to register, check out the Black Hat website.

Article source: https://www.darkreading.com/black-hat/black-hat-asia-offers-new-iot-security-tools-and-tricks/d/d-id/1333712?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Fraudsters masquerading as ISP support agents to phish payment card details have been unmasked – after they tried to scam a Brit infosec biz cofounder.

Kurtis Baron, director of the Cambridge-based penetration-testing outfit Fidus Information Security, told El Reg today how his cofounder Andrew Mabbitt received a private message from what appeared to be a legit Virgin Media customer support account on Twitter, a message that tried to harvest his bank card details.

The scam began when Mabbitt complained publicly to UK broadband giant Virgin Media on Twitter about a dodgy internet connection. A crook, operating a Virgin Media support lookalike account, clocked the gripe, and slid into his DMs asking for personal details to help out. Said details included things like confirming his card number.

“It was a very good attempt,” Mabbitt said in his summary of the attack.

“It seems those behind the account(s) are watching for keywords in real time and sending these messages very quickly; exploiting both the speed of a reply and the frustration being held by the person writing the initial tweet.”

Detailed: How Russian government’s Fancy Bear UEFI rootkit sneaks onto Windows PCs

READ MORE

Spotting the phishing attempt early on, our protagonist decided to play along with the ruse, giving the fraudsters a fictional name and address – in this case, the address being the Met Police, on Savile Row in London, and the name being Wade Wilson aka Marvell’s potty-mouthed super-merc Deadpool.

Not realizing they were trying to con a comic-book antihero operating out of the capital’s police HQ, the dimwit criminals proceeded to ask for payment card details. It was here that Mabbitt truly reeled them in, giving the scammers a dummy credit card number PayPal uses to let merchants test their payment systems. He also sent them links to a Fidus honeypot server for the miscreants to follow, revealing their public IP address (assuming they weren’t smart enough to use something like Tor).

It was apparent at this point that Mabbitt was not exactly dealing with criminal masterminds. Still, the attackers were smart enough to not follow the first links he sent, and asked for a second credit card number when the test card details failed to authorize a charge. Mr Wilson had to go a bit deeper with his social engineering.

“Our intention here was clear, we wanted them to browse to an IP which we were hosting a webserver on to grab their IP address. Sadly, it wasn’t as easy as we had hoped so we had to lay some more groundwork,” Mabbitt said.

“They were adamant they needed another card, we were adamant we were going to get their IP address. It became a back and forward exchange.”

Mabbitt stepped up his game by claiming American Express was at fault, and crafted a fake Cloudflare error page, hosted by the honeypot server, and passed a link to that page to the crooks to try to prove that the credit-card company was having website issues. Even that, however, failed to convince them to click on his link.

Finally, Mabbitt faked a screenshot of an SMS message that appeared to come from American Express warning of potential fraudulent activity on his card, and sent the pic to to the scammers. The text contained a link to a honeypot-hosted page that apparently had more details about the fraud alert. Hoping to cancel the alert, and unlock the card, the criminals clicked on the link, and revealed their IP address to the Fidus honeypot.

“Never did I think we’d be faking both CloudFlare error messages and SMS’ to gain an IP address but we had come too far at this point to back out now,” Mabbitt said.

At that point, Mabbitt pulled the plug, reporting the account and the IP address to Twitter and the Met Police. While the fate of the criminals is unknown, the lookalike Virgin Media Twitter account has since been suspended.

Let this be a lesson to would-be scammers. If you’re going to resort to defrauding people with fake Twitter accounts, scope out your mark, lest you end up trying to con a comic book hero with a honeypot server and a Met Police address. Or, preferably, just don’t even start. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/23/scammers_virgin_media_honeypot/

Analysis Following uproar from developers and netizens over proposed changes to Chrome that threaten to break content and ad blockers, and knacker other browser extensions, Google software engineer Devlin Cronin has offered reassurance that the plans aren’t set in stone.

“This design is still in a draft state, and will likely change,” he said in a message posted to the Chromium extensions user group.

“Our goal is not to break extensions. We are working with extension developers to strive to keep this breakage to a minimum, while still advancing the platform to enhance security, privacy, and performance for all users.”

Cronin stressed that transparency and openness are central to Chromium – the open-source project upon which Google Chrome is built – and that the project welcomes technical input.

Google also issued a follow-up statement suggesting willingness to work with the developer community: “These changes are in the design process, as mentioned in the document and the Chromium bug. We want to make sure all fundamental use cases are still possible with these changes and are working with extension developers to make sure their extensions continue to work.”

Google’s intent appears to represent an effort to push back against the assumption voiced by some developers that these changes were driven by a desire to protect its ad business from content and ad blocking extensions.

Floating a test balloon

Google first floated the changes in October last year in a blog post describing a plan to make browser extensions more trustworthy. The plan outlined user controls to restrict which sites extensions can access, banning extension developers from using obfuscated code and changing the Chrome extension review process.

Google also announced Manifest v3, a draft revision of its Chrome Extension platform and the source of current developer distress. The company at the time acknowledged the revised specification might require extension developers to rewrite their code, but it insisted any breaking changes “will be worth that effort for all users, developers, and for the long term health of the Chrome extensions ecosystem.”

But many developers see Google’s plan to improve user privacy and security doing just the opposite. “I believe these changes will prevent numerous security extensions from functioning correctly,” said Claudio Guarnieri, senior technologist and researcher at Amnesty International, in a post to the Chromium Extensions discussion group where Cronin asked people to offer input (rather than Chromium’s bug tracker).

Manifest v3 describes various changes to the application programming interfaces (APIs) available to developers of Chrome Extensions. The most troubling of these for makers of extensions is the effort to encourage a switch from the webRequest API to the declarativeNetRequest API.

The declarativeNetRequest API is designed as an alternative for webRequest, which is used – among other things – for content blocking applications. Google intends to limit webRequest‘s ability to manipulate network requests, for the sake of security, performance, and privacy, while offering declarativeNetRequest as the preferred API going forward.

Google’s stated reasons for making these changes sound reasonable, even if the consequences may not have been completely thought out. Extensions can pose a security risk and extension developers can get access to more information than necessary.

As the company notes in its Manifest v3 documentation, as of August 2018, 80 per cent of the top 1,000 extensions request access to all domains, allowing them to inject scripts, intercept network requests, and read cookies for any domain. As with phone apps that demand broader-than-necessary permissions, this is a matter of legitimate concern, although not necessarily an indication of bad behavior.

Developers aren’t pleased

But the consequence of enhanced security and privacy looks to mean less capable extensions and limitations on the kinds of tools available to browser users. Raymond Hill creator of uBlock Origin called attention to problems with the Manifest v3 proposal by warning that his extensions won’t work under the more limited API.

Following Hill’s complaint, others made their concerns known through the Chromium extensions user group. Daniel Glazman, co-CTO and veep of engineering at Privowny, said the proposed changes would drastically affect his company’s software.

The declarativeNetRequest API does not (as presently drafted) allow extensions to modify network requests as the webRequest API does. It can only block or redirect requests, which makes content blockers much less capable. It also limits the number of rules that can be applied to process network requests to 30,000.

That may be sufficient for an extension like Adblock Plus that relies on a fairly limited filter list, but it falls short for more ambitious extensions. Stefano Traverso, CTO of Ermes Cyber Security, said some anti-phishing lists contain millions of entries.

For what it’s worth, Adblock Plus uses a filter list with more than 70,000 entries, twice that of the proposed API limit. And while this means Adblock Plus will be affected to some degree by the suggested changes, which has irritated its makers, other extensions, such as the more advanced uBlock Origin, will be hit much harder by the API overhaul.

Wow, fancy that. Web ad giant Google to block ad-blockers in Chrome. For safety, apparently

READ MORE

Cronin acknowledges the tightening of access will upset some developers. “I certainly understand that there are a number of concerns around limiting the power of the webRequest API in favor of a declarative API – it is much more restrictive, and doesn’t offer the flexibility the webRequest API does,” he wrote in a post to the discussion group.

But there’s more to it than one API change. Manifest v3 includes a variety of other changes that will affect extension developers. For example, it directs developers to replace background pages, by which extensions could run code in the background, with a more modern background process API called Service Workers, a change that Glazman says will mean months of work for his company.

He warns that Mozilla and Apple in the past both took steps that harmed their extension ecosystems with ill-advised changes. And he said the WebExtensions API isn’t managed like a web standard and should be, noting that Microsoft’s effort to address standardization through a W3C Community Group failed miserably.

“I urge Google to resurrect a real and active standardization effort around WebExtensions,” he said.

“This is the only part of the browser space that is not handled that way, and we clearly see today with the v3 proposal that it is not workable for third-party implementers any more. We just cannot cope with deep changes of high magnitude in a timely manner. The financial impact of the proposed changed on extension vendors is vastly underestimated (if estimated at all), and that alone should be a showstopper signal from a strategic point of view.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/23/google_chrome_extension_change/

Modular design, ability to infect network shares make the malware dangerous, McAfee says.

A new and potentially dangerous ransomware sample has been spotted infecting computers in the United States and at least nine other countries so far.

McAfee, the first to discover the emerging menace, has dubbed it Anatova, based on a name in the ransom note the malware leaves behind on infected systems.

In an advisory Tuesday, the security vendor described Anatova as having the potential to become a serious threat based on its obfuscation capabilities and ability to infect network shares. The malware also has a modular design, which allows attackers to add new malicious functions to it in the future.

Researchers from McAfee first discovered Anatova on a private peer-to-peer network, but they are still unsure of all the other ways the malware is being distributed. The malicious software typically has been using the icon of a game or application to trick users into downloading it on their systems.

Once executed, Anatova takes a variety of actions to avoid detection and ensure it can find and encrypt as many files as possible on an infected system. The malware then leaves behind a note demanding the equivalent of $700 in ransom for the key to decrypt the data.

“Anatova makes a few checks to make sure it is not run in a sandbox and the victim is not from certain countries,” says Christiaan Beek, lead scientist at McAfee. Users from former Soviet bloc nations and some other countries, including Syria, Iraq, and India, are currently not under threat from the new ransomware strain.

Once it has gone past the initial checks, the malware looks for files that are smaller than 1 MB but makes sure not to disrupt the operating system while doing so. It also checks for network shares and will try to encrypt files in those locations. “One infection can disrupt a large part of an enterprise,” Beek warns.

Significantly, each Anatova sample has its own key, meaning there’s no master key available that could decrypt all files for all victims. Each victim would need a specific, separate key in order to unlock encrypted files, he explains.

After encrypting, the ransom note is written to the system. “It will then clean the memory so no keys can be dumped and [then] overwrites the backup files — volume shadow copies – 10 times to make sure that no backup of local files is possible,” Beek notes. Anatova’s modular design gives malware authors a way to add capabilities that would allow the malware to be distributed over the network or change its behavior while running.

Anatova is another sign that the ransomare threat is far from over, though there appears to be some uncertainty over whether the number of attacks are growing or declining. Kaspersky Lab, for instance, in December estimated that attacks involving crypto-ransomware had increased 43% in 2018 compared with the year before. But others have noted a decrease in ransomware attacks matched by a corresponding increase in attacks involving banking Trojans and cryptomining tools.

Regardless of the way the attacks are trending, most security researchers concur that ransomware continues to present a major threat for organizations. Last year numerous organization suffered major disruptions and financial losses from ransomware attacks, including The City of Atlanta, Port of San Diego, electronic health record provider Allscripts, and Hancock Health.

“Ransomware is a still a threat we have to take seriously,” Beek says. “Be prepared, and do not pay. Paying will keep this business model alive.”

According to McAfee, the developers and actors behind Anatova appear to be skilled malware authors. Though researchers at the company have a few theories on who is behind the new threat, it’s still too early to jump to conclusions, Beek says. “We believe this was a prototype being tested and has a potential to become a serious threat,” he says.

Related Content:

• Ransomware Actors Cut Loose on Health Care Organizations
• 3 Keys to Reducing the Threat of Ransomware
• Satan Ransomware Variant Exploits 10 Server-Side Flaws
• 2019 Attacker Playbook

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/anatova-emerges-as-potentially-major-new-ransomware-threat/d/d-id/1333714?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple